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INSPECTOR  GENERAL 
DEPARTMENT  OF  DEFENSE 
400  ARMY  NAVY  DRIVE 
ARLINGTON,  VIRGINIA  22202-4704 


July  15,  2009 

MEMORANDUM  FOR  DIRECTOR,  DEFENSE  FINANCE  AND  ACCOUNTING 

SERVICE 


SUBJECT :  Validity  of  DoD  Civilian  Employee  Accounts 
(Report  No.  D-2009-092) 


We  are  providing  this  report  for  your  information  and  use.  We  considered  management 
comments  from  the  Defense  Finance  and  Accounting  Service  when  preparing  the  final 
report. 

Comments  on  the  draft  of  this  report  conformed  to  the  requirements  of  DoD  Directive 
7650.3  and  left  no  unresolved  issues.  Therefore,  we  do  not  require  any  additional 
comments. 

We  appreciate  the  courtesies  extended  to  the  staff.  Please  direct  questions  to  me  at 
(703)  601-5868. 


n 


Patricia  A.  Marsh,  CPA 
Assistant  Inspector  General 
Defense  Business  Operations 
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Results  in  Brief:  Validity  of  DoD  Civilian 
Employee  Accounts 


What  We  Did 

Our  audit  objective  was  to  determine  whether 
the  Defense  Finance  and  Accounting  Service 
(DFAS)  made  payments  to  valid  DoD  civilian 
employee  accounts.  See  Appendix  A  for  a 
discussion  of  the  scope  and  methodology  related 
to  the  objective. 

What  We  Found 

As  of  May  2008,  the  Defense  Civilian  Pay 
System  (DCPS)  included  7.3  million  DoD 
civilian  employee  accounts  with  more  than  $148 
billion  in  taxable  earnings  during  the  period 
January  2002  through  April  2008  (excluding 
taxable  earnings  for  calendar  year  2007). 
However,  DFAS  did  not  ensure  that  DCPS 
contained  only  valid  DoD  civilian  employee 
accounts.  Specifically,  DCPS  included  invalid 
Social  Security  numbers,  employees  under  the 
legal  employment  age,  and  multiple  employee 
accounts  that  shared  the  same  bank  account.  As 
a  result,  DFAS  may  have  paid  approximately 
$15.4  million  to  more  than  2,300  invalid  DoD 
civilian  employee  accounts  from  January  2002 
through  April  2008  (excluding  2007).  By 
reviewing  the  DoD  civilian  employee  accounts 
identified  and  ensuring  the  accuracy  of  future 
accounts,  DFAS  will  reduce  the  likelihood  of 
paying  invalid  DoD  civilian  employees. 

DFAS  internal  controls  were  not  adequate.  We 
identified  internal  control  weaknesses  in  the 
administration  of  DoD  civilian  employee 
accounts.  See  the  finding  section  for  further 
details  on  the  internal  control  weaknesses. 


What  We  Recommend 

We  recommend  that  the  Director,  DFAS: 

•  Review  all  accounts  identified  in  this 
report  and  take  appropriate  corrective 
action  to  recover  improper  payments 
made  to  invalid  DoD  civilian  employee 
accounts; 

•  Establish  policies  and  procedures  to 
validate  Social  Security  numbers  for 
DoD  civilian  employee  accounts; 

•  Revise  the  DFAS  Civilian  Pay  standard 
operating  procedure,  “Death  in  Service,” 
to  include  identifying  deceased 
employees  and  recovering  improper 
payments; 

•  Establish  policies  and  procedures  to 
validate  employees  under  the  legal 
employment  age;  and 

•  Establish  policies  and  procedures  to 
validate  multiple  employees  who  share 
the  same  bank  account. 

Management  Comments  and 
Our  Responses 

The  Director,  Standards  and  Compliance, 
agreed  with  five  recommendations  in  the  report. 
The  comments  were  responsive  to  five 
recommendations.  Please  see  the 
recommendations  table  on  the  back  of  this  page. 
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Introduction 

Objective 

Our  audit  objective  was  to  determine  whether  the  Defense  Finance  and  Accounting 
Service  (DFAS)  made  payments  to  valid  DoD  civilian  employee  accounts.  See 
Appendix  A  for  a  discussion  of  the  scope  and  methodology  related  to  the  objective. 

Background 

When  a  DoD  agency  hires  a  new  civilian  employee,  the  human  resource  office  gathers 
personal  and  position-related  information  and  forwards  it  to  the  hiring  agency’s  customer 
service  representative.  The  customer  service  representative  creates  an  employee  account 
within  the  Defense  Civilian  Personnel  Data  System  (DCPDS)  using  the  new  civilian 
employee’s  Social  Security  number  (SSN).  DCPDS  is  a  human  resource  information 
system  maintained  by  the  Civilian  Personnel  Management  Service  (CPMS)  that  supports 
DoD  civilian  personnel  operations.  DCPDS  retains  employee  names,  birth  dates,  and 
job-related  information  and  electronically  transfers  personal  and  position-related 
information  to  DFAS  Civilian  Pay  for  payment  processing.  DCPDS  maintained 
approximately  800,000  DoD  civilian  employee  accounts  during  FY  2007. 

DFAS  Civilian  Pay 

DFAS  Civilian  Pay  is  responsible  for  ensuring  that  DoD  civilian  payroll  is  processed 
accurately  and  in  a  timely  manner.  Initially,  DFAS  processed  DoD  civilian  payroll  at 
three  offices  located  in  Charleston,  South  Carolina;  Denver,  Colorado;  and  Pensacola, 
Florida.  From  March  2007  through  March  2008,  the  civilian  payroll  offices  were 
consolidated  and  transferred  to  Cleveland,  Ohio  and  Indianapolis,  Indiana.  DFAS 
Civilian  Pay  also  processes  payroll  for  the  Executive  Office  of  the  President,  the 
Department  of  Energy,  the  Department  of  Health  and  Human  Services,  and  the 
Department  of  Veterans  Affairs. 

Civilian  Payroll  Processing 

DFAS  Civilian  Pay  uses  the  Defense  Civilian  Pay  System  (DCPS)  to  process  biweekly 
payroll.  DCPS  maintains  pay  entitlements,  leave  entitlements,  deductions  and 
withholdings,  time  and  attendance,  and  other  employee  account  information.  DCPS 
normally  includes  only  one  pay  account  for  each  employee  and  identifies  it  by  their  SSN. 
For  employees  to  receive  pay,  their  agency  timekeeper  must  first  enter  biweekly 
time-and-attendance  data  within  DCPS.  Once  the  agency  timekeeper  enters  time  and 
attendance,  DCPS  begins  a  series  of  automated  reviews.  These  reviews  validate  time  and 
attendance,  update  the  master  leave  history,  calculate  pay,  and  produce  exception  reports 
identifying  potential  errors.  DFAS  Civilian  Pay  must  resolve  errors  identified  during 
these  reviews  prior  to  payroll  approval.  Once  DFAS  resolves  all  errors,  DCPS 
electronically  transfers  the  payroll  information  to  DFAS  Disbursing  Operations. 
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Disbursements  to  DoD  Civilian  Employees 

DFAS  Disbursing  Operations  at  Cleveland,  Ohio  disburses  payroll  to  all  DoD  civilian 
employees  using  the  Automated  Disbursing  System.  The  Automated  Disbursing  System 
disburses  the  majority  of  payroll  by  electronic  funds  transfer.  However,  some  DoD 
civilian  employees  still  receive  paper  checks  from  the  Automated  Disbursing  System. 
These  civilian  employees  obtained  waivers  for  physical,  mental,  or  financial  hardship  to 
receive  paper  checks. 

Review  of  Internal  Controls 

We  identified  internal  control  weaknesses  as  they  relate  to  the  audit  objective.  DFAS 
Civilian  Pay  policies  and  procedures  were  not  adequate  to  identify  invalid  DoD  civilian 
employee  accounts  within  DCPS.  Specifically,  DFAS  Civilian  Pay  did  not  ensure  that 
DCPS  contained  only  valid  DoD  civilian  employee  accounts.  Implementing 
recommendations  1,  2,  3,  4,  and  5  will  strengthen  policies  and  procedures  to  ensure  that 
DCPS  includes  valid  DoD  civilian  employee  accounts  and  to  reduce  the  likelihood  of 
improper  payments.  We  will  provide  a  copy  of  the  final  report  to  the  senior  official 
responsible  for  internal  controls  in  DFAS. 
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Finding.  Validity  of  DoD  Civilian  Employee 
Accounts 

As  of  May  2008,  DCPS  included  7.3  million  DoD  civilian  employee  accounts  with  more 
than  $148  billion  in  taxable  earnings  during  the  period  January  2002  through  April  2008 
(excluding  taxable  earnings  for  calendar  year  2007). 1 2  However,  DFAS  did  not  ensure 
that  DCPS  contained  only  valid  DoD  civilian  employee  accounts.  Specifically,  DCPS 
included  invalid  SSNs,  employees  under  the  legal  employment  age,  and  multiple 
employee  accounts  that  shared  the  same  bank  account.  DFAS  Civilian  Pay  policies  and 
procedures  were  not  adequate  to  identify  invalid  DoD  civilian  employee  accounts  within 
DCPS.  As  a  result,  DFAS  may  have  improperly  paid  approximately  $15.4  million  to 
more  than  2,300  invalid  DoD  civilian  employee  accounts  from  January  2002  through 
April  2008  (excluding  2007).  By  reviewing  the  DoD  civilian  employee  accounts 
identified  and  ensuring  the  accuracy  of  future  accounts,  DFAS  will  reduce  the  likelihood 
of  paying  invalid  DoD  civilian  employees. 

Criteria  for  the  Validity  of  DoD  Civilian  Employee  Accounts 

The  Fair  Labor  Standards  Act,  section  213,  title  29,  United  States  Code,  established  the 
minimum  legal  employment  age.  The  act  identifies  14  as  the  minimum  age  for  most 
nonagricultural  workers.  It  also  states  that  an  employee  under  the  age  of  14  is  limited  to 
working  as  a  newspaper  deliverer,  babysitter,  actor,  or  for  their  family-owned  business  or 
farm. 

DoD  Financial  Management  Regulation  7000. 14-R,  volume  8,  chapter  1,  “Introduction 
and  Overall  Requirements,”  July  2008,  requires  DFAS  to  ensure  that  entitled  individuals 
are  paid  accurately  and  promptly.  It  also  requires  that  inappropriate  data  detected  be 
investigated  promptly  and  appropriate  action  taken  to  correct  discrepancies. 

Validity  of  DoD  Civilian  Employee  SSNs 

DCPS  contained  invalid  SSNs  because  DFAS  Civilian  Pay  did  not  have  policies  and 
procedures  to  validate  SSNs.  Specifically,  from  January  2002  through  April  2008 
(excluding  2007),  DCPS  contained  101  SSNs  with  earnings  of  approximately  $297,000 
that  were  invalid,  according  to  the  Social  Security  Administration  (SSA).  SSA  outlines 
the  structure  of  the  SSN  and  the  sequence  in  which  SSNs  are  issued.  The  SSN  has  nine 
digits,  with  hyphens  as  separators  before  the  fourth  and  sixth  digits.  The  first  three  digits 
are  called  the  area  number  and  are  assigned  by  State.  The  next  two  digits  are  called  the 
group  number  and  are  assigned  for  administrative  purposes.  The  final  four  digits  are 
called  the  serial  number  and  are  issued  sequentially.  SSA  guidelines  state  that  none  of 


1  DFAS  Civilian  Pay  was  unable  to  provide  taxable  earnings  from  DCPS  for  calendar  year  2007.  DFAS 
personnel  stated  that  they  were  transferring  2007  data  to  the  DCPS  Data  Repository  when  we  requested  the 
audit  universe,  which  prevented  DFAS  Civilian  Pay  from  extracting  taxable  earnings  for  2007. 

2  We  did  not  identify  any  differences  between  the  DoD  Financial  Management  Regulation  in  effect  when 
the  DoD  civilian  employees  were  originally  paid  and  the  current  DoD  Financial  Management  Regulation 
that  would  affect  the  results  of  the  review. 
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the  three  individual  numbers  of  the  SSN  can  be  entirely  comprised  of  zeros.  For 
example,  a  SSN  of  123-00-1234  is  invalid  because  the  group  number  contains  all  zeros. 
DCPS  included  three  SSNs  that  included  zeros  in  one  of  the  three  individual  numbers. 

The  audit  team  contacted  DFAS  Civilian  Pay  to  validate  the  SSNs.  A  DFAS  Civilian  Pay 
representative  stated  that  they  rely  on  the  employing  agency  and  that  we  should  request 
the  supporting  documentation  from  CPMS.  As  a  result,  the  audit  team  asked  CPMS  to 
provide  supporting  documentation  for  the  three  invalid  SSNs.  After  four  weeks,  CPMS 
had  not  provided  any  supporting  documentation. 

DCPS  also  contained  98  SSNs  that  SSA  had  not  issued.  SSA  guidelines  specify  the 
maximum  values  that  have  been  used  to  create  area  and  group  number  combinations  as  a 
way  to  help  employers  verify  new  employees’  SSNs.  According  to  SSA,  any  SSNs  that 
exceed  these  guidelines  are  invalid.  When  the  audit  team  asked  DFAS  Civilian  Pay  to 
validate  some  of  the  SSNs,  a  DFAS  Civilian  Pay  representative  stated  that  they  rely  on 
the  employing  agency  to  validate  SSNs  and  that  we  should  request  supporting 
documentation  from  CPMS.  As  a  result,  the  audit  team  asked  CPMS  to  provide 
supporting  documentation  for  19  of  the  98  invalid  SSNs.  After  four  weeks,  CPMS 
provided  supporting  documentation  for  5  invalid  SSNs  that  indicated  data  entry  errors, 
but  CPMS  did  not  provide  documentation  for  the  remaining  14  invalid  SSNs. 

Even  though  CPMS  provided  us  with  some  documentation,  DFAS  Civilian  Pay  is 
responsible  for  ensuring  that  SSNs  contained  in  DCPS  are  accurate,  because  accurate 
SSNs  are  critical  to  ensuring  that  entitled  employees  receive  pay.  A  correct  SSN  is  also 
important  because  it  allows  SSA  to  properly  credit  the  employee’s  earnings  record. 

DFAS  Civilian  Pay  can  validate  future  SSNs  by  using  the  SSN  Verification  Service 
provided  by  SSA.  This  free  service  allows  users  to  compare  names  and  SSNs  of 
employees  with  SSA  records.  DFAS  Civilian  Pay  should  review  the  invalid  SSNs  and 
establish  polices  and  procedures  to  validate  future  SSNs. 

Deceased  Employee  SSNs 

DCPS  contained  134  SSNs  with  earnings  of  more  than  $905,000  for  deceased  employees 
from  January  2002  through  April  2008  (excluding  2007).  The  DFAS  Civilian  Pay 
standard  operating  procedure,  “Death  in  Service,”  did  not  include  procedures  to  identify 
deceased  employees  and  recover  improper  payments.  This  guidance  focused  only  on 
identifying  and  calculating  compensation  payable  to  the  beneficiary.  As  a  result,  DCPS 
contained  134  SSNs  for  deceased  employees  that  DFAS  continued  to  pay  for  more  than 
three  pay  periods  after  they  died.  For  example,  one  employee  had  a  reported  date  of 
death  of  March  1948  and  still  received  $1 1,613  in  2002.  The  audit  team  compared  the 
134  SSNs  to  the  Social  Security  Death  Index  Web  site  to  verify  that  the  employees  were 
deceased.  Using  the  interactive  search,  we  matched  44  employees  to  the  Social  Security 
Death  Index,  indicating  that  the  employees  were  deceased.  These  44  deceased  civilian 
employees  were  erroneously  paid  a  total  of  more  than  $3 12,379  after  they  died.  We  also 
identified  86  deceased  employees  whose  names  in  DCPS  did  not  match  their  names  in  the 
Social  Security  Death  Index.  These  instances  demonstrate  the  potential  for  fraud, 
because  employees  may  submit  the  SSN  of  a  deceased  individual  instead  of  their  own. 
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The  audit  team  was  unable  to  verify  the  deaths  of  four  of  the  employees  reported  as 
deceased. 

The  audit  team  contacted  DFAS  Civilian  Pay  to  validate  some  of  the  deceased 
employees.  A  DFAS  Civilian  Pay  representative  stated  that  they  rely  on  the  employing 
agency  to  do  this  and  that  we  should  request  supporting  documentation  from  CPMS.  As 
a  result,  the  audit  team  asked  CPMS  to  provide  supporting  documentation  for  20  of  134 
deceased  employees.  After  four  weeks,  CPMS  provided  supporting  documentation  for 
1 1  of  these  20  deceased  employees.  CPMS  provided  supporting  documentation  for  6  of 
the  1 1  deceased  employees  whose  records  indicated  data  entry  errors.  For  the  other  five 
deceased  employees,  supporting  documentation  indicated  that  the  employee  was 
deceased.  CPMS  did  not  provide  documentation  for  9  of  the  20  deceased  employees. 

Although  CPMS  was  able  to  provide  us  with  some  documentation,  DFAS  Civilian  Pay  is 
responsible  for  ensuring  that  only  entitled  employees  receive  pay.  DFAS  Civilian  Pay 
did  not  attempt  to  identify  deceased  employees  and  recover  improper  payments. 

However,  DFAS  has  the  ability  to  identify  deceased  employees  through  the  Defense 
Manpower  Data  Center,  which  it  currently  utilizes  in  DFAS  Retired  and  Annuitant  Pay  to 
identify  deceased  retired  military  members.  The  Defense  Manpower  Data  Center 
compares  the  SSA  Death  Master  File  with  employee  accounts  and  reports  the  matches  to 
DFAS.  The  SSA  Death  Master  File  is  an  extensive  database  containing  information  on 
deceased  individuals  who  were  issued  SSNs.  The  Defense  Manpower  Data  Center  could 
also  assist  DFAS  Civilian  Pay  in  identifying  deceased  civilian  employees.  DFAS 
Civilian  Pay  should  review  and  recover  improper  payments  made  to  deceased  civilian 
employees.  Additionally,  DFAS  Civilian  Pay  should  revise  its  policies  and  procedures  to 
include  identifying  deceased  employees  and  recovering  improper  payments. 

DoD  Civilian  Employee  Ages 

DCPS  showed  employees  that  were  under  the  legal  employment  age  because  DFAS 
Civilian  Pay  did  not  have  policies  and  procedures  in  place  to  validate  employee  birth 
dates.  Specifically,  from  January  2002  through  April  2008  (excluding  2007)  DCPS 
contained  1,921  accounts  with  earnings  of  approximately  $2.3  million  for  employees  that 
were  under  the  legal  employment  age  of  14.  In  2006,  one  employee  had  a  birth  date  of 
April  1998  and  received  payments  totaling  $12,236.  The  audit  team  contacted  DFAS 
Civilian  Pay  to  validate  some  of  the  birth  dates.  A  DFAS  Civilian  Pay  representative 
stated  that  they  rely  on  the  employing  agency  to  do  this  and  that  we  should  request  the 
supporting  documentation  from  CPMS.  The  audit  team  asked  CPMS  to  provide 
supporting  documentation  for  7  of  1,921  accounts  with  ages  under  the  legal  limit.  After 
three  weeks,  CPMS  did  not  provide  any  supporting  documentation  but  stated  that  the 
birth  dates  included  in  DCPDS  were  accurate.  The  audit  team  compared  the  birth  dates 
in  DCPS  to  DCPDS  and  identified  that  1,916  of  1,921  accounts  for  employees  were  still 
under  the  legal  employment  age  of  14.  By  law,  these  employees  were  not  entitled  to 
receive  payments.  Additionally,  we  identified  five  accounts  that  were  the  result  of 
potential  data  entry  errors. 
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DFAS  Civilian  Pay  did  not  have  policies  and  procedures  in  place  to  validate  employee 
birth  dates,  although  DCPS  identifies  employees  under  the  legal  employment  age.  When 
a  DCPS  account  is  established,  DCPS  compares  the  birth  date  against  the  current  date 
and  creates  a  warning  message  identifying  employees  under  the  legal  employment  age. 
DFAS  Civilian  Pay  representatives  ignored  these  warning  messages  and  still  processed 
employees’  pay,  allowing  DCPS  to  include  employees  under  the  legal  employment  age  of 
14.  A  DFAS  Civilian  Pay  representative  stated  that  DFAS  Civilian  Pay  should  contact 
the  Human  Resource  Office  to  verify  the  birth  dates.  However,  DFAS  Civilian  Pay 
standard  operating  procedures  do  not  require  such  verification,  ft  is  DFAS  Civilian  Pay’s 
responsibility  to  ensure  that  entitled  employees  receive  accurate  and  prompt  payments. 
The  accuracy  of  birth  dates  is  critical  to  ensuring  that  employees  are  of  legal  employment 
age,  and  DFAS  Civilian  Pay  should  ensure  that  birth  dates  contained  within  DCPS  are 
accurate.  DFAS  Civilian  Pay  should  review  current  employees  under  the  legal 
employment  age  of  14  and  establish  policies  and  procedures  to  validate  employees  under 
the  legal  employment  age. 

Employees  with  the  Same  Bank  Account 

DCPS  contained  multiple  employee  accounts  that  shared  the  same  bank  account. 
Specifically,  from  January  2002  through  April  2008  (excluding  2007),  DCPS  contained 
186  employee  accounts  that  received  earnings  of  approximately  $1 1.9  million  into  16 
different  bank  accounts.  DFAS  Civilian  Pay  could  not  identify  these  employees  because 
it  did  not  have  policies  and  procedures  in  place  to  identify  multiple  employees  sending 
payments  to  the  same  bank  account.  Each  employee’s  net  pay  is  assigned  to  one  bank 
account  type,  account  number,  and  routing  number  within  DCPS.  Couples  employed  by 
DoD  agencies  commonly  share  the  same  banking  information  for  receiving  their  net  pay. 
However,  DCPS  showed  16  different  hank  accounts  to  which  at  least  three  DoD  civilian 
employees  were  sending  payroll  deposits.  For  example,  DCPS  contained  52  different 
employee  accounts  that  had  received  earnings  of  more  than  $3.4  million  into  the  same 
hank  account.  The  audit  team  asked  DFAS  Civilian  Pay  to  provide  supporting 
documentation  for  the  186  employee  accounts.  After  three  weeks,  DFAS  Civilian  Pay 
had  not  provided  any  supporting  documentation  for  these  accounts.  DFAS  Civilian  Pay 
should  review  the  accounts  with  multiple  employees  depositing  to  the  same  bank  account 
and  establish  policies  and  procedures  to  validate  them. 

Conclusion 

DFAS  may  have  improperly  paid  approximately  $15.4  million  to  more  than  2,300  invalid 
DoD  civilian  employee  accounts  from  January  2002  through  April  2008  (excluding 
2007).  Payments  made  to  ineligible  recipients  are  considered  improper  payments. 

Invalid  employee  accounts  in  DCPS  increase  the  likelihood  of  improper  payments. 

DFAS  Civilian  Pay  must  ensure  that  DoD  civilian  employee  accounts  are  accurate, 
because  accurate  account  information  is  critical  to  ensuring  that  only  entitled  employees 
receive  pay.  DFAS  is  also  required  to  promptly  investigate  inappropriate  employee 
accounts  and  take  appropriate  action  to  correct  discrepancies.  However,  DFAS  Civilian 
Pay  did  not  take  appropriate  action  to  ensure  that  DoD  civilian  employee  accounts  were 
correct. 
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We  requested  that  the  Defense  Criminal  Investigative  Service  review  the  invalid  DoD 
civilian  employee  accounts  identified  within  this  report.  The  Defense  Criminal 
Investigative  Service,  with  assistance  from  DFAS  Internal  Review,  Columbus,  Ohio, 
agreed  to  review  invalid  SSNs  and  accounts  with  multiple  employees  depositing  to  the 
same  bank  account. 

Management  Comments  on  the  Finding  and  Our 
Response 

Defense  Finance  and  Accounting  Service  Comments 

The  Director,  Standards  and  Compliance,  suggested  that  we  should  include  the  scope  of 
payments  and  define  the  deficiency  percentages  within  the  Results  in  Brief  and  Finding 
sections.  He  referred  to  our  Appendix,  which  stated  that  there  were  a  combined  7.3 
million  accounts  paid  during  the  period  in  question  for  more  than  $148  billion  and  noted 
that  the  potential  error  amounted  to  0.03  percent  of  the  accounts  and  0.01  percent  of  the 
dollars.  The  Director,  Standards  and  Compliance,  also  stated  that  we  should  discuss  the 
sample  of  accounts  reviewed  and  remarked  that  DFAS  had  worked  with  CPMS  to  verify 
the  findings  for  50  accounts  in  each  of  the  four  areas.  (Specifically,  DFAS  reviewed  20 
accounts  with  invalid  social  security  numbers,  20  accounts  of  deceased  employees,  and 
10  accounts  of  employees  under  the  legal  employment  age.)  According  to  the  Director, 
Standards  and  Compliance,  for  all  accounts  that  are  in  an  online  production  environment, 
DFAS  found  that  the  civilian  payments  included  some  form  of  coding  error,  but  the 
payments  were  proper  and  made  to  an  authorized  recipient.  After  acknowledging  that  the 
audit  objective  was  “to  determine  whether  the  DFAS  made  payments  to  valid  DoD 
civilian  employee  accounts,”  the  Director,  Standards  and  Compliance,  also  stated  that  we 
should  make  a  recommendation  regarding  CPMS,  which  provides  the  source  data  and  it 
is  critical  to  implementing  effective  corrective  actions.  He  stated  that  there  has  to  be  a 
certain  reliance  placed  on  the  provider  of  the  information.  DFAS  is  working  with  CPMS 
to  research  and  implement  corrective  actions  for  this  report. 

Our  Response 

Based  on  comments  from  the  Director,  Standards  and  Compliance,  we  added  that  DCPS 
included  7.3  million  DoD  civilian  employee  accounts  with  more  than  $148  billion  in 
taxable  earnings  during  the  period  January  2002  through  April  2008  (excluding  taxable 
earnings  for  calendar  year  2007)  to  the  Results  in  Brief  and  Finding  sections.  However, 
we  did  not  include  deficiency  percentages  because  the  percentages  do  not  consider  the 
actual  number  of  DoD  civilian  employee  accounts  that  received  pay.  Only  a  portion  of 
the  7.3  million  DoD  civilian  employee  accounts  in  DCPS  received  pay  during  January 
2002  through  April  2008  (excluding  2007).  DFAS  deficiency  percentages  assume  that  all 
7.3  million  DoD  civilian  employee  accounts  received  pay  during  the  time  period 
reviewed  by  the  audit  team.  We  also  are  unable  to  address  the  sample  of  accounts 
reviewed  because  DFAS  did  not  provide  any  documentation  supporting  its  account 
analysis  and  conclusions.  DFAS  is  also  still  researching  17  of  50  (34  percent)  accounts 
reviewed  because  it  has  limited  or  no  information  in  its  online  production  environment. 
Additionally,  DFAS  has  not  initiated  a  review  of  multiple  employee  accounts  that  shared 
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the  same  bank  account,  which  represents  $1 1.9  million  of  the  $15.4  million  identified 
during  the  audit.  We  recognize  and  support  DFAS  working  with  CPMS  to  research  and 
implement  corrective  actions  for  this  report.  However,  DFAS  is  ultimately  responsible 
for  ensuring  that  only  entitled  employees  receive  pay.  It  also  needs  to  ensure  that  DCPS 
includes  accurate  DoD  civilian  employee  account  information,  because  accurate  account 
information  is  critical  to  ensuring  that  only  entitled  employees  receive  pay. 

Recommendations,  Management  Comments,  and  Our 
Response 

We  recommend  that  the  Director,  Defense  Finance  and  Accounting  Service: 

1.  Review  all  accounts  identified  in  this  report  and  take  appropriate  corrective 
action  to  recover  improper  payments  made  to  invalid  DoD  civilian  employee 
accounts. 

Defense  Finance  and  Accounting  Service  Comments 

The  Director,  Standards  and  Compliance,  agreed  and  stated  that  all  accounts  identified  in 
the  report  are  being  reviewed  to  determine  whether  any  improper  payments  have  been 
made  and  to  take  appropriate  corrective  action.  Corrective  action  will  be  completed  by 
October  1,  2009. 

2.  Establish  policies  and  procedures  to  validate  Social  Security  numbers  for  DoD 
civilian  employee  accounts. 

Defense  Finance  and  Accounting  Service  Comments 

The  Director,  Standards  and  Compliance,  agreed  and  stated  that  a  system  change  request 
was  submitted  on  April  23,  2009,  to  ensure  that  SSNs  within  the  DCPS  met  SSA 
guidelines.  The  DFAS  Civilian  Pay  Standards  and  Compliance  team  will  also  work  with 
CPMS  to  determine  the  most  efficient  method  to  validate  SSNs  and  provide  an  estimated 
implementation  date  of  new  policies  and  procedures.  Corrective  action  will  be  completed 
by  October  1,  2009. 

3.  Revise  the  Defense  Finance  and  Accounting  Service  Civilian  Pay  standard 
operating  procedure,  “Death  in  Service,”  to  include  identifying  deceased  employees 
and  recovering  improper  payments. 

Defense  Finance  and  Accounting  Service  Comments 

The  Director,  Standards  and  Compliance,  agreed  and  stated  that  the  DFAS  Civilian  Pay 
Standards  and  Compliance  team  will  review  the  “Death  in  Service”  standard  operating 
procedure  and  make  revisions  as  necessary.  The  Director,  Standards  and  Compliance 
also  stated  that  the  team  will  work  with  CPMS  to  review  current  procedures  for  potential 
improvements  and  provide  an  estimated  implementation  date  of  new  policies  and 
procedures.  Corrective  action  will  be  completed  by  October  1,  2009. 
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4.  Establish  policies  and  procedures  to  validate  employees  under  the  legal 
employment  age. 

Defense  Finance  and  Accounting  Service  Comments 

The  Director,  Standards  and  Compliance,  agreed  and  stated  that  CPMS  confirmed  that 
edits  were  added  to  DCPDS  in  January  2009  to  eliminate  invalid  birthdates  within 
personnel  records.  The  Director,  Standards  and  Compliance,  also  stated  that  any 
erroneous  modifications  within  DCPS  would  be  corrected  based  on  Personnel/Payroll 
reconciliation  between  the  two  systems.  Corrective  action  was  completed  on 
April  14,  2009. 

5.  Establish  policies  and  procedures  to  validate  multiple  employees  who  share  the 
same  bank  account. 

Defense  Finance  and  Accounting  Service  Comments 

The  Director,  Standards  and  Compliance,  agreed  and  stated  that  DFAS  will  look  at 
possible  options  to  identify  and  review  multiple  employees  sharing  the  same  hank 
account.  The  Director,  Standards  and  Compliance  also  stated  that  it  is  common  for 
members  of  the  same  household  to  share  a  bank  account  for  their  net  pay,  and  not  all 
banks  establish  unique  account  numbers  for  all  of  their  customers;  therefore,  a 
reasonability  edit  will  be  looked  at  when  establishing  review  and  validation  procedures. 
Corrective  action  will  be  completed  by  October  1,  2009. 

Our  Response 

Comments  from  the  Director,  Standards  and  Compliance,  are  responsive  and  conform  to 
requirements.  No  additional  comments  are  needed. 
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Appendix.  Scope  and  Methodology 

We  conducted  this  performance  audit  from  March  2008  through  March  2009  in 
accordance  with  generally  accepted  government  auditing  standards.  Those  standards 
require  that  we  plan  and  perform  the  audit  to  obtain  sufficient,  appropriate  evidence  to 
provide  a  reasonable  basis  for  our  findings  and  conclusions  based  on  our  audit  objectives. 
We  believe  that  the  evidence  obtained  provides  a  reasonable  basis  for  our  findings  and 
conclusions  based  on  our  audit  objectives. 

To  review  the  validity  of  DoD  civilian  employee  accounts,  we  evaluated  the  DoD  civilian 
payment  process  and  reviewed  data  contained  within  multiple  Defense  agency  databases. 
As  of  May  2008,  DCPS  included  7.3  million  DoD  civilian  employee  accounts  with  more 
than  $148  billion  in  taxable  earnings  during  the  period  January  2002  through  April  2008 
(excluding  taxable  earnings  for  calendar  year  2007).  Using  Audit  Command  Language, 
we  identified  a  subuniverse  of  2,342  invalid  accounts.  We  identified  invalid  accounts 
within  the  audit  universe  by  applying  data  queries  related  to  SSNs,  birth  dates,  and 
employees  with  the  same  bank  accounts.  We  requested  documentation  for  235  invalid 
accounts  (for  a  total  of  approximately  $12.8  million)  from  the  subuniverse  to  detennine 
the  reason  that  DCPS  included  invalid  accounts.  We  contacted  representatives  from  the 
Office  of  the  Under  Secretary  of  Defense  (Comptroller)/DoD  Chief  Financial  Officer;  the 
Office  of  the  Under  Secretary  of  Defense  for  Personnel  and  Readiness;  DFAS  Civilian 
Pay;  DFAS  Disbursing  Operations;  and  CPMS. 

To  accomplish  the  audit  objective,  we  perfonned  the  following  tasks. 

•  We  met  with  representatives  from  DFAS  Pensacola,  Florida,  to  gain  an  overall 
understanding  of  the  DoD  civilian  payment  process  and  obtain  the  universe  of 
DoD  civilian  employee  accounts.  Specifically,  we  reviewed  roles  and 
responsibilities  of  system  personnel  and  some  system  and  access  controls. 
Additionally,  we  reviewed  justifications  for  the  requested  documentation. 

•  We  met  with  representatives  from  DFAS  Civilian  Pay,  Cleveland,  Ohio,  and 
Indianapolis,  Indiana,  to  determine  the  payroll  process  for  DoD  civilian  employee 
accounts.  Specifically,  we  reviewed  payroll  processes,  roles  and  responsibilities 
of  payroll  personnel,  payroll  standard  operating  procedures,  and  some 
DCPS-generated  reports.  Additionally,  we  reviewed  justifications  for  the 
requested  documentation. 

•  We  met  with  representatives  from  the  DFAS  Disbursing  Operations,  Cleveland, 
Ohio,  to  determine  the  disbursement  process  for  DoD  civilian  payments  and  to 
obtain  Automated  Disbursing  System  and  manual  check  payments  for  comparison 
against  DCPS  data.  Specifically,  we  reviewed  the  civilian  payment  process,  roles 
and  responsibilities  of  disbursing  personnel,  disbursement  standard  operating 
procedures,  and  some  system  and  access  controls.  Additionally,  we  reviewed 
disbursement  documentation. 
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•  We  met  with  representatives  from  CPMS  to  gain  an  understanding  of  the 

personnel  process  and  to  obtain  DCPDS  data  for  comparison  against  DCPS  data. 
Specifically,  we  reviewed  the  personnel  process,  roles  and  responsibilities  of 
CPMS  personnel,  and  some  system  and  access  controls.  Additionally,  we 
reviewed  personnel  file  documentation  provided  by  CPMS. 

Use  of  Computer-Processed  Data 

To  perform  this  audit,  we  used  data  that  originated  in  DCPS.  DCPS  is  the  official 
civilian  payroll  system  for  DoD.  Each  year,  DoD  Office  of  Inspector  General  auditors 
assess  DCPS  controls.  We  determined  data  reliability  by  comparing  DoD  civilian 
employee  account  data  to  DCPDS,  the  Automated  Disbursing  System,  and  personnel  file 
documentation.  These  assessments  indicated  that  the  data  was  sufficiently  reliable  to 
accurately  reflect  the  payments  for  the  purpose  of  our  review. 

Use  of  Technical  Assistance 

Quantitative  Methods  and  Analysis  Division  personnel  in  the  DoD  Office  of  Inspector 
General  assisted  with  obtaining  data  from  DCPS,  DCPDS,  and  the  Automated  Disbursing 
System.  They  uploaded  data  into  the  Audit  Command  Language  and  ran  queries  to  assist 
in  identifying  a  subuniverse  of  potentially  invalid  accounts.  They  also  coordinated  with 
the  Defense  Manpower  Data  Center  to  obtain  SSA  Death  Master  File  infonnation  for  the 
audit  universe.  They  also  assisted  with  identifying  SSNs  that  were  never  issued  by  SSA. 

Prior  Coverage 

No  prior  coverage  has  been  conducted  on  detennining  the  validity  of  DoD  civilian 
employee  accounts  during  the  last  5  years. 
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Defense  Finance  and  Accounting  Service  Comments 


Final  Report 
Reference 


DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 
ARLINGTON 
1851  SOUTH  BELL  STREET 
ARLINGTON,  VA  22240-5291 


MAY  2  2  2009 


MEMORANDUM  FOR  DIRECTOR,  DEFENSE  FINANCIAL  AUDITING  SERVICE, 
OFFICE  OF  THE  INSPECTOR  GENERAL,  DoD 

SUBJECT:  DFAS  Comments  to  DoDIG  Draft  Report,  “Validity  of  DoD  Civilian  Employee 
Accounts”,  dated  March  3 1 , 2009,  Project  D2008-D000FC-0 1 56.000. 


Attached  are  management  comments  to  DoDIG  Draft  Report,  “Validity  of  DoD 
Civilian  Employee  Accounts”,  dated  March  31,  2009,  for  recommendations  1-5. 

We  worked  with  the  Civilian  Personnel  and  Management  Service  (CPMS)  to  verify 
the  findings  for  50  of  the  potential  improper  payments  in  your  sample.  For  all  accounts  that 
are  in  our  online  production  environment,  we  found  that  the  civilian  payments  included  some 
form  of  coding  error,  but  the  payments  were  proper  and  made  to  an  authorized  recipient. 

Due  to  the  age  of  your  sample,  efforts  to  research  aged  payments  back  to  2002  will  take  time 
as  the  information  is  archived  in  a  historical  repository. 

Your  Appendix  identifies  that  there  were  a  combined  7.3  million  accounts  paid  during 
the  period  in  question  for  more  than  $148  billion.  This  is  omitted  from  the  “Results  in  Brief’ 
and  “Finding"  sections  of  the  report,  where  you  identify  that  there  were  2,300  invalid 
accounts  for  a  potential  erroneous  payment  of  $15.4  million.  As  a  deficiency  percentage  the 
potential  errors  amount  to  0.03%  of  the  accounts  and  0.01%  of  the  dollars  We  feel  this  fact 
should  be  disclosed  in  the  “Results  in  Brief’  and  “Finding”  sections.  We  suggest  that  you 
modify  your  report  to  include  language  that  identifies  the  scope  of  payments  and  language 
t  tat  more  clearly  defines  the  deficiency.  For  example,  “Improvements  are  needed  in  CPMS 
certified  personnel  feeds  to  payroll  to  ensure  that  coding  errors  due  not  exist  and  payments 
are  accurate.  Defense  Finance  and  Accounting  Service  (DFAS)  paid  7.3  million  employees 
taxable  earnings  of  $148  billion  between  January  2002  and  April  2008  (excluding  2007) 
However,  DFAS  did  not  ensure  that  the  Defense  Civilian  Payroll  System  contained  only 
valid  DoD  civilian  employee  accounts.  Specifically,  the  Defense  Civilian  Payroll  System 
included  invalid  Social  Security  numbers,  employees  under  the  legal  employment  age,  and 
multiple  employee  accounts  that  shared  the  same  bank  account.  As  a  result  DFAS  may  have 
paid  approximately  $15.4  million  (0.01%)  to  2,342  (0.03%)  invalid  DoD  civilian  employee 
accounts.  We  provided  DFAS  personnel  a  sample  of  the  accounts  in  each  of  the  four  areas 
we  found  problems.  For  the  accounts  in  an  online  production  environment,  DFAS  validated 
that  the  sampled  accounts  included  coding  errors  in  the  pay  account  information,  but  found 
no  erroneous  payments  as  the  recipients  were  entitled  to  payment.  DFAS  plans  to  continue 
to  review  the  remaining  potential  errors  to  validate  whether  a  coding  error  was  corrected  in  a 
subsequent  pay  period,  or  an  actual  erroneous  payment  was  made.  By  reviewing  the  DoD 
civilian  employee  accounts  identified  and  ensuring  the  accuracy  of  future  accounts,  DFAS 
will  reduce  the  likelihood  of  paying  invalid  DoD  civilian  employees.” 


www.dod.mil/dfas 
Your  Financial  Partner  (3)  Work 


Added  Pages 
i  and  3 
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In  general,  there  has  to  be  a  certain  reliance  placed  on  the  provider  of  the  information. 
In  the  cases  cited,  the  CPMS  forwards  employee  data  to  DFAS,  whether  the  employee  is 
newly  hired  or  deceased,  and  include  various  data  elements,  e.g.,  birth  date.  The  stated 
objective  of  the  audit  was  “to  determine  whether  the  DFAS  made  payments  to  valid  DoD 
civilian  employee  accounts.”  We  are  working  with  CPMS  to  research  and  implement 
corrective  actions  from  this  report.  For  issues  identified  with  the  largest  area  of  deficiencies 
“employee  ages”,  we  worked  with  CPMS  to  identify  coding  errors  on  7  of  the  10  records 
provided  in  the  sample  with  none  of  them  identified  as  improper.  Corrective  actions  have 
been  implemented  which  include: 

-  Payroll  office  receives  a  warning  message  for  extremely  young  and  old  employees. 
The  pay  technician  contacts  the  personnel  office  for  verification.  The  interfacing 
personnel  system  is  responsible  for  verification  of  employee  date  of  birth  and  passing 
the  information  to  the  payroll  system. 

-  CPMS  added  edits  to  Defense  Civilian  Personnel  Data  System  in  January  2009  to 
identify  and  correct  personnel  records  having  invalid  birthdates  that  are  under  the 
legal  employment  age. 

We  recommend  that  CPMS  be  included  in  your  recommendations  since  they  provide 
the  source  data  and  are  critical  to  implementing  effective  corrective  actions. 

DFAS  Internal  Review  also  performed  analysis  on  the  Cleveland  Civilian  Payroll 
Office's  databases  and  recommended  management  actions  to  correct  coding  errors  between 
personnel  and  payroll  by  performing  timely  reconciliations  of  the  data. 


Attachment: 
As  stated 
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DFAS  Comments  to  DoDIG  Draft  Report,  “Validity  of  DoD  Civilian  Employee 
Accounts”,  dated  March  31,  2009,  Project  D2008-D000FC-0 156.000. 

We  Recommend  that  the  Director,  Defense  Finance  and  Accounting  Service: 

Recommendation  1:  Review  all  accounts  identified  in  this  report  and  take  appropriate 
corrective  action  to  recover  improper  payments  made  to  invalid  DoD  civilian  employee 
accounts. 

Management  Comments:  Concur.  Accounts  identified  in  this  report  are  being 
reviewed  to  determine  if  any  improper  payments  have  been  made  and  to  take  appropriate 
corrective  action.  Corrective  actions  to  each  account  will  be  completed  as  soon  as 
possible  upon  identification. 

Estimated  Completion  Date:  October  1,  2009 

Recommendation  2:  Establish  policies  and  procedures  to  validate  Social  Security 
numbers  for  DoD  civilian  employee  accounts. 

With  respect  to  the  section  “Validity  of  DoD  Civilian  Employee  Accounts,”  we 
recommend  adding  the  following:  “We  provided  DFAS  personnel  a  sample  of  20 
accounts  of  the  98  we  identified  as  not  issued  by  SSA.  DFAS,  in  coordination  with 
CPMS,  found  that  12  have  been  corrected  by  human  resources  and  eight  have  limited 
information  that  DFAS  is  working  with  CPMS  to  research.  In  addition,  of  the  three 
accounts  with  an  invalid  SSN  structure,  only  one  was  different  than  DCPDS.” 

Management  Comments:  Concur. 

a.  The  Civilian  Pay  Standards  and  Compliance  (S&C)  team  has  reviewed  the  format 
constraints  for  social  security  numbers  (SSNs)  based  on  SSA  guidance.  Defense 
Civilian  Pay  System  (DCPS)  System  Change  Request  #Y3 1 1 1  (Social  Security 
Number  Edits  for  Employee)  has  been  established  to  add  appropriate  edits. 

Completion  Date:  April  23,  2009 

b.  The  interfacing  personnel  system  is  responsible  for  verification  of  social  security 
numbers  (SSNs)  and  for  providing  the  payroll  system  with  transactions  including 
that  data.  The  Civilian  Pay  S&  C  team  will  work  with  the  Civilian  Personnel 
Management  Service  (CPMS),  who  owns  the  DoD  personnel  system,  to  determine 
the  most  efficient  method  to  validate  the  SSN  against  those  assigned  and  provide 
an  estimated  implementation  date  of  new  policies  and  procedures. 

Estimated  Completion  Date:  October  1, 2009 
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Recommendation  3:  Revise  the  Defense  Finance  and  Accounting  Service  Civilian 
Pay  standard  operating  procedure,  “Death  in  Service,”  to  include  identifying 
deceased  employees  and  recovering  improper  payments. 

\\  ith  respect  to  the  section  "Deceased  Employees  SSNs,  we  recommend  adding 
the  following:  “We  provided  DFAS  personnel  a  sample  of20  accounts  of  the  134  we 
identified.  DFAS,  in  coordination  with  CPMS,  found  eight  accounts  have  been  corrected 
by  human  resources,  and  three  had  erroneous  death  dates.  The  remaining  nine  accounts 
will  require  additional  research  from  the  archived  repository  as  the  information  is  not  in 
the  online  production  environment.” 

Management  Comments:  Concur. 

a.  The  Civilian  Pay  S&C  team  will  review  the  “Death  in  Service”  standard  operating 
procedure  and  make  revisions  as  necessary. 

Estimated  Completion  Date:  October  1,  2009 

b.  The  interfacing  personnel  system  is  responsible  for  verification  of  employee  death 
certificates  and  passing  that  information  to  the  payroll  system.  The  Civilian  Pay 
S&C  team  will  work  with  CPMS  to  review  current  procedures  for  potential 
improvement  and  provide  an  estimated  implementation  date  of  new  policies  and 
procedures. 

Estimated  Completion  Date:  October  1,  2009 

Recommendation  4:  Establish  policies  and  procedures  to  validate  employees  under 
the  legal  employment  age. 

With  respect  to  the  section  DoD  Civilian  Employee  Ages,”  we  recommend 
adding  the  following:  “We  provided  DFAS  personnel  a  sample  of  10  accounts  of  the 
1 ,92 1  we  identified.  DFAS,  in  coordination  with  CPMS,  found  that  five  had  been 
corrected  by  human  resources,  three  separated  prior  to  being  corrected,  and  two  separated 
before  being  corrected  but  were  rehired  with  the  correct  date  of  birth.” 

The  payroll  office  receives  a  warning  message  for  extremely  young  and  old 
employees.  The  pay  technician  contacts  the  personnel  office  for  verification.  The 
payroll  office  does  not  have  the  information  to  validate  the  date  of  birth. 

Management  Comments:  Concur.  The  interfacing  personnel  system  is  responsible  for 
verification  of  employee  date  of  birth  and  passing  the  information  to  the  payroll  system. 
CPMS  has  confirmed  the  edits  were  added  to  DCPDS  on  January  2009.  This  will 
eliminate  the  personnel  records  having  invalid  birthdates  that  are  under  the  legal 
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employment  age.  Any  erroneous  modifications  done  within  DCPS  will  be  corrected 
based  on  the  Personnel/Payroll  reconciliation  between  the  two  systems. 

Completion  Date:  April  14,2009 

Recommendation  5:  Establish  policies  and  procedures  to  validate  multiple 
employees  who  share  the  same  bank  account. 

Management  Comments:  Concur.  DFAS  will  look  at  possible  options  to  identify  and 
review  multiple  employees  sharing  the  same  bank  account  for  their  net  pay.  It  is  not 
uncommon  for  members  of  the  same  household  to  share  a  bank  account  for  their  net  pay 
and  not  all  banks  establish  unique  account  numbers  for  all  their  customers;  therefore  a 
reasonability  edit  will  be  looked  at  when  establishing  review  and  validation  procedures. 

Estimated  Completion  Date:  October  1,  2009 
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